Power the Infectus, it crashes the PS3 and leaves the NANDs in powered mode:

Use the console to power the NANDs: power it up until the PS3 crashes and halts with red flashing LED, press power again to stop the flashing, but keeps the console powered on. The NANDs are not accessed by the PS3 in this way, so it doesn't matter if the NAND content is already messed up. After that, you can read/write the NANDs.

Use the Infectus to read the 2 different NAND chips. You get 2 files this way, one for each NAND : flash0.bin & flash1.bin

256 with 3.6x downgrade INFECTUS nands [and other consoles repair waninbrick]
Hi, I've been working on this project for about 2 months now and, now that I know it works, I'm making it public so everyone can use it, this tutorial is for PS3s with 256mb NAND flashes, this doesn't mean it might not work on 16mb ones, the modification part is almost the same with NOR flashes, but since my 80gb PS3, which has a 16mb, is still ****ed up, I haven't had the opportunity to try it or verify it.
Let's go to the point (Translator's Note: a jargon is being used here, "turron" is replaced for "grano" since both are hard things):
With infectus, we extract our NAND flash0.bin and flash1.bin and, just like in lukin's tutorial for repairing bad NANDs, we do the same process until we get our 256mb flashfinal.bin dump.
We open this NAND with a simple hex editor and search for this part:
"00 00 00 00 00 00 00 00 00 00 00 00 00 6F FF E0"
You'll see that right below there's a very similar line, I found this data in the 000C0020 offset, it might vary depending on the NAND. Ok, so here's where the fun starts :D
Replace, INCLUDING THAT LINE with the 1patchcos.bin file.
If you're using hxd, put it in the first 0 (zero) of that line -> right click and paste while writing. Before that you need to have open 1patchcos.bin in hxd and you need to copy all its content to be able to paste it.
Next, we're going to patch the second file, let's search in our dump with hxd the following part:
"00 00 00 00 00 00 10 10 00 00 00 00 00 00 10 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 40"
Just like with the first file, you need to patch this one the same way. We grab the 2patchtrvk.bin from the pack and replace all its content, including
"00 00 00 00 00 00 10 10 00 00 00 00 00 00 10 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 40"
After that, open them with flowrebuilder and use the "reescramble this dump" option so we can have generated our flash0.ECC.bin and flash1.ECC.bin again.
Flash the results. When you're done, you'll notice that when you start up your PS3, you'll have in front of you a nice little black screen. So now, grab your jig and put it in factory service mode, choose factory. Then, grab your good old lv2diag and whatever PUP you want.
(WARNING: The first PUP you put, will remain as the lowest downgradable version (Translator's note: does that make sense? Lol), now if you want to downgrade from 3.55 to 3.41, you'll need to put the 3.41 PUP before upgrading to 3.55, if not, it will stay at 3.55 because, otherwise, you'll have to go and write the dump all over again to be able to downgrade lower than the first PUP you put.)
Now, put lv2diag to get out of factory service and you're done.
Notes:
this also goes for repairing Waninkoko's brick without a donated NAND including sem-001 boards (proved) (and were downgraded that in the process xD)
Thanks:
to everyone at #darkps3 from irc-hispano for supporting me all this time.
to austaquio32 for donating infectus that made me finish this project.
to Nodial2ne for his help tracing files in the NAND.
to robs1 for helping in all this process with his idea that made this possible.
and to everyone that was patient and did not annoyed me with PMs.
Ungrateful to:
er_poty : every post I make, he starts a flame, and annoys me with PMs saying I'm not even at the same level of PDNKED
PS: I've being unemployed for 4 years. If anyone wants to donate anyways, you can contact me via PM (I'm sorry but I have 2 child and the PS3 doesn't feed them or me xD)
Either that or give me an f'n job! xD
PS3s compatibles with this method (Thanks pdnked):
PS3 Fat:
CECHA = 256MB
CECHB = 256MB
CECHC = 256MB
CECHE = 256MB
CECHG = 256MB

After being investigating nand's I found a solution. Let's patch a functional nand OFW 3.55 with our "keys" (bootloader_0, bootloader_1, IED, ISD, and metldr vtrm) console. This will enable USB ports and will begin factory mode.

Attention! If you have not much experience with the soldering iron, start practicing with old motherboards. . I am not responsible for any damage that may occur in your console.

I use two infectus because it failed to detect both nands me. (Just go twice as fast in read / write) xD.

"I have evidence that there is no need to feed the nands as the flashing red light is sufficient, however I failed to detect without food for another site. Turning on the power-supply source. "We connect the pc infectus.

"We opened PS3NANDProgramer 1.41 (" LOAD DLL "then" connect "and we choose flash0 or flash1). If the solders are correct, we will leave the data nands "Flash info" (otherwise check with tester soldering points in the nand). "The process of reading is around 15 minutes approx. "It is advisable to take more than two dump's of nands. (In case you have bad blocks, but infectus say no bad blocks).

Compare nands (flash0 and flash1) with Hex workshop program: TOOLS -> compare (select two of the same nand dumps) and found that they are identical. (Repeat the same with flash1). Guard well the CFW nands Wanin like gold brick. xD

First of all we will extract the contents of nand brick, then will patch our "keys" in the new nand.

"We opened FlowRebuilder350 "We selected the two nand CFW extracted in step 2 and select the output file. We would like to "dump" if the order of nands is right we will create a peak of 264 megawatts and a series of folders.

In one of these we find (FDI, CSD, metldr, bootloader_0, bootloader_1, ISD, vtrm) and core_os. (LV0, lv2, lv2_kernel.self .... spu's and others.)

"We opened FlowRebuilder230 "We selected the two nand's (flash0 and flash1) OFW and choose the output file (interpolate nand's).

"Now we need to patch "We opened the nand nand WFC ofw and brick with hex editor that you like best. "Now we are copying the sectors of our nand to nand functional. (Find and replace). [With Hex workshop 6 you can see what you have checked, bottom right [cursor / caret / sel]

We open with 230 NandFlowRebuilder selecionamos "Desinterpolate in new Flashes."
-You select flash0 and flash1 (with the same order as in step 3b) and finally your arhiva patched.
The third tab, select the file that previously we had saved.
-Tight "Do Process" (we hope to complete successfully)
XD finish and now having the dumps XXX2.NEW XXXX.NEW and proceed to repair the ECC.
"We opened 1.30 NANDECC select the input file and the output, then click the" do process ". (We do this twice, once for each nand).
The ECC has to be repaired in the order of (450-550) if it is the wrong patched nand.

"We opened PS3NandProgrammer 1.41 and delete [ERASE] on the nand's content. (Repeat the process two or three times removed) "Then write the [WRITE] the two nands. (How the process of writing takes about 45minutes). (We found no bad blocks, if any, check solering).

Now infectus disconnecting the pc, if you turn on the console, the LED should flash orange hd. (If it is not patched review and write nand nand.) (Because you have a bug)

Our console still does not work, however well-lit and read the usb ports. Nand has encrypted a file system (not yours). So let's create the new file system from nand. By having the correct keys on the console so you can enter factory mode and install the 3.55 v2 waninkoko frimware. (Do not probeis OFW factory when they leave you will have a nice brick mode again.)

"Once we introduce written PSGRADE / PSKEY ... etc, JIG mode, turn on the console (power + eject), will shut down to 20sec, then enter the pen with lv2diag.self and waninkoko update v2.

"After 10 minutes the console will turn off and will return to life. Then enter the pen with lv2diag.self [file2] and out of factory mode.

And this xD, the console and is alive! [Desoldering infectus and mount the console]

OK, so we all know about how the original Waninkoko firmware broke the older large NAND consoles, that was due to him overwriting some portions of Cell-OS Lv2 and the segment boundaries, god knows about the signature also. He also zeroed out a good section of the kernel, and also breaks some NAND consoles due to that. Now, you want to fix this issue? Well, you have to have:

OK, so you first have to dump both NAND chips (2 128MB NANDs for a total of 256MB) and interleave them using Flow Rebuilder, then decrypt the CORE_OS package to give you a raw core OS image, then open your combined NAND dump in a hex editor and search for “6F FF E0″ in the search for hex section. Once there, you should see:

Right after the second “6F FF E0″, remove the next 7,340,000 bytes, then, insert the unpacked Core OS (7,340,000 bytes). Then split the image using Flow Rebuilder (use ECC!) and flash. Hopefully it should work, and then you can just Lv2diag your way out.